Trust

Security

Remote access means someone can use your computer from somewhere else, so it has to be locked down. Here’s how ORelay does it and how to report a problem.

Updated October 16, 2026

How ORelay protects your computers

Nothing on your computer is open to the internet. The ORelay app only ever calls out, so there’s no port to open on your router. (For IT folks: mutual TLS 1.3, with certificates from our own certificate authority.)
We never store your password itself, only a scrambled version that can’t be turned back into it. Sign-ins expire after 15 minutes and renew quietly in the background. (For IT folks: salted Argon2id hashes; refresh tokens are replaced every time they’re used.)
Accounts are by invitation only. Beside your password you can add a passkey, or Google, Apple, Microsoft or GitHub sign-in, and two-step sign-in is there for everyone.
Each organization’s computers, readings, alerts, scheduled tasks and software lists live in their own database. Sharing a computer gives the other person that one computer and nothing else.
The person at the computer stays in charge. An administrator there can turn off screen viewing, control, commands, files or power, and ORelay refuses anything that’s turned off. Everything is on until they change it.
We log who did what, including the text of each command. We never record the screen itself, or anything typed during a remote desktop or command-window session.
Windows and Mac versions are signed by ORelay Studios LLC, and Linux packages with our package signing key. An update is installed only if it is exactly what we published.

Found a problem? Tell us first.

Use the form on our Support page and choose “A security issue”. Tell us what you found, how to make it happen and what it affects. We’ll reply within five business days, keep you updated, and credit you if you’d like. We don’t offer a paid bug bounty.

If you follow our disclosure policy, your research is covered by its safe harbor. In short: test only with your own accounts and computers, don’t disrupt anything, stop if you reach someone else’s data, and give us 90 days before going public. Read the full disclosure policy on orelay.io. It covers this website too, but not our web host, WordPress itself or its plugins.